Author Topic: What is this strange systray icon??  (Read 14926 times)

0 Members and 1 Guest are viewing this topic.

Offline szc

  • Avast Evangelist
  • Starting Graphoman
  • ***
  • Posts: 6927
Re: What is this strange systray icon??
« Reply #15 on: December 03, 2005, 12:31:49 PM »
MSN/Hotmail and Yahoo are special cases since, to most users, they do not publish a POP3 mail server. 

Most of the "tray resident" utilities like Pop-peeper work by using POP3 connections to read the list of email being held on a user's mail server.  There are other utilities that work for MSN/Hotmail and Yahoo by performing a HTTP screen-scrape to get the list of messages held on those servers.

By using plug-ins your POP Peeper can check Hotmail without any single problem... other thing, it works with gmail just like a charm. In the very near future it will have IMAP support as well (AOL, AIM, FasMail etc.).



My buddy Jeff (POP Peeper developer) is already working on those things and I am happy to say, 90% of that task is already done and almost ready for upcomming version 3.0

http://www.poppeeper.com/whatscoming.php
MB: GIGABYTE GA-Z77X-UD3H Intel 7 Series  - LGA1155, CPU: Intel Core i5-3570K - Quad Core, 3.40GHz (3.80GHz Max Turbo), CPU COOLER: Cooler Master Hyper 212 EVO Direct Heat Pipe R2, RAM: 16 GB Kingston HyperX Blu DDR3, VIDEO CARD: Galaxy GeForce GTX 560 Ti - 1GB, GDDR5, POWER SUPPLY: Corsair Enthusiast Series TX750 V2 - 750 Watts, HD: Seagate Barracuda - 2TB, 7200RPM, 64MB, SATA 6Gb/s

Offline oldman

  • Avast Evangelist
  • Massive Poster
  • ***
  • Posts: 4142
  • Some days..... MOS...this bug's for you
Re: What is this strange systray icon??
« Reply #16 on: December 03, 2005, 08:26:07 PM »

As I already mentioned before, lack of information from his side will keep us wondering... why people never post some basic information about their systems prior asking those questions ? If we have enough time to spend helping them (again, for free), why don't they take some time to help us ? If they help us a bit in the beginning, then we can help them much more and much faster.......

I've been other forums with the same problem. Some of them have a topic that stays at the top called "Tips On Posting". This gives new posters a heads up on what they should include in their posts. ie OS, Cpu, AV's running, exact error message etc..

Maybe the administrators coud set this up? It sure would help.

Oh yeah, posters should post back results no matter if successful or not.

Sorry to hijack this thread, but it is kinda relevent to the original poster and I can tell that these posts do get read, so admin probably will see this.
« Last Edit: December 03, 2005, 08:43:01 PM by oldman »

Offline szc

  • Avast Evangelist
  • Starting Graphoman
  • ***
  • Posts: 6927
Re: What is this strange systray icon??
« Reply #17 on: December 03, 2005, 08:31:19 PM »
No this is not hijacked thread at all, and all those things you said are wonderful and it could help a lot. If just forum moderators see your suggestion I'm sure we could work something out...

Thanks again !
MB: GIGABYTE GA-Z77X-UD3H Intel 7 Series  - LGA1155, CPU: Intel Core i5-3570K - Quad Core, 3.40GHz (3.80GHz Max Turbo), CPU COOLER: Cooler Master Hyper 212 EVO Direct Heat Pipe R2, RAM: 16 GB Kingston HyperX Blu DDR3, VIDEO CARD: Galaxy GeForce GTX 560 Ti - 1GB, GDDR5, POWER SUPPLY: Corsair Enthusiast Series TX750 V2 - 750 Watts, HD: Seagate Barracuda - 2TB, 7200RPM, 64MB, SATA 6Gb/s

aleph

  • Guest
Re: What is this strange systray icon??
« Reply #18 on: December 05, 2005, 12:33:57 PM »
Wow, haven't check back in a couple days and it seems this tread has been busy.

Answers to a few questions:

This is a new, self-built system.  I've done a couple reinstalls.  Previous installs I noticed the icon up with various different IP addresses.  None stayed connected for long enough to be able to write them down.  Is there a LOG option somewhere inside avast! where I can track this?

On my present reinstall -- running pretty much as I want it.  I have imported old emails into outlook express, but I have not established any accounts.  I'm still checking email online.  I run no memory-resident email prog, and would not. 

The last IP, and the one that prompted the creation of this thread was 200.104.22.78

I sat down at my computer and the icon was up with this ip address.  It stayed up for a few minutes (maybe 4) then disappeared...  Have not seen it again.  Wish I could log this IP traffic somehow...

Follows, a list of normally running processes

aleph

  • Guest
Re: What is this strange systray icon??
« Reply #19 on: December 05, 2005, 12:42:59 PM »
--------[ Processes ]-----------------------------

ashDisp.exe     C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe              1024 KB          2816 KB
ashMaiSv.exe    C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe  612 KB          5560 KB
ashServ.exe     C:\Program Files\Alwil Software\Avast4\ashServ.exe   4972 KB         24264 KB
ashWebSv.exe    C:\Program Files\Alwil Software\Avast4\ashWebSv.exe  760 KB          5884 KB
aswUpdSv.exe    C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe  40 KB           408 KB
CTDetect.exe    C:\Program Files\Creative\MediaSource\Detector\CTDetect.exe 384 KB           932 KB
CTsvcCDA.EXE    C:\WINNT\system32\CTsvcCDA.EXE                       36 KB           356 KB
Explorer.EXE    C:\WINNT\Explorer.EXE                                5876 KB         14352 KB
firefox.exe     C:\Program Files\Mozilla Firefox\firefox.exe         60624 KB         61304 KB
javaw.exe       C:\Program Files\Java\jre1.5.0_05\bin\javaw.exe      122 MB           173 MB
jusched.exe     C:\Program Files\Java\jre1.5.0_05\bin\jusched.exe    36 KB           504 KB
lsass.exe       C:\WINNT\system32\lsass.exe                          1332 KB          2404 KB
mqsvc.exe       C:\WINNT\system32\mqsvc.exe                          760 KB          1848 KB
msdtc.exe       C:\WINNT\system32\msdtc.exe                          664 KB          1992 KB
msiexec.exe     C:\WINNT\system32\msiexec.exe                        6584 KB          2008 KB
MsPMSPSv.exe    C:\WINNT\system32\MsPMSPSv.exe                       44 KB           516 KB
MSTask.exe      C:\WINNT\system32\MSTask.exe                         244 KB          1088 KB
NOTEPAD.EXE     C:\WINNT\system32\NOTEPAD.EXE                        3400 KB           836 KB
nvsvc32.exe     C:\WINNT\system32\nvsvc32.exe                        316 KB           904 KB
PDVDServ.exe    C:\Program Files\PowerDVD\PDVDServ.exe               40 KB           596 KB
regsvc.exe      C:\WINNT\system32\regsvc.exe                         124 KB           272 KB
Rundll32.exe    C:\WINNT\system32\Rundll32.exe                       128 KB          1580 KB
RUNDLL32.EXE    C:\WINNT\system32\RUNDLL32.EXE                       156 KB          1564 KB
services.exe    C:\WINNT\system32\services.exe                       3908 KB          4636 KB
smss.exe        C:\WINNT\System32\smss.exe                           36 KB          1084 KB
spoolsv.exe     C:\WINNT\system32\spoolsv.exe                        1152 KB          2528 KB
stisvc.exe      C:\WINNT\system32\stisvc.exe                         232 KB          1220 KB
svchost.exe     C:\WINNT\system32\svchost.exe                        1276 KB         10336 KB
svchost.exe     C:\WINNT\system32\svchost.exe                        1624 KB          1552 KB
svchost.exe     C:\WINNT\system32\svchost.exe                        2908 KB          3988 KB
taskmgr.exe     C:\WINNT\system32\taskmgr.exe                      1396 KB           784 KB
tcpsvcs.exe     C:\WINNT\system32\tcpsvcs.exe                        208 KB          1072 KB
TeaTimer.exe    C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe   5160 KB          5700 KB
vsmon.exe       C:\WINNT\system32\ZoneLabs\vsmon.exe                 11232 KB         14424 KB
winlogon.exe    C:\WINNT\system32\winlogon.exe                       2288 KB          5972 KB
WinMgmt.exe     C:\WINNT\System32\WBEM\WinMgmt.exe                   564 KB          1064 KB
zlclient.exe    C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe

aleph

  • Guest
Re: What is this strange systray icon??
« Reply #20 on: December 05, 2005, 12:52:30 PM »
More system info:
OS Name                               Microsoft Windows 2000 Professional
OS Language                        English (United States)
OS Kernel Type                      Multiprocessor Free
OS Version                             5.0.2195 (Win2000 Retail)
OS Service Pack                     Service Pack 4

Motherboard:
   CPU Type           DualCore AMD Athlon 64 X2, 2000 MHz (10 x 200) 3800+
   Motherboard Name   MSI K8N Diamond / K8N SLI Platinum (MS-7100)  (3 PCI, 2 PCI-E x16, 4 DDR DIMM, Audio, Gigabit LAN, IEEE-1394)
   Motherboard Chipset                               nVIDIA nForce4 SLI, AMD Hammer
   System Memory                                     1024 MB  (PC3200 DDR SDRAM)
   BIOS Type                                         Award (09/09/05)
   Communication Port                                Communications Port (COM1)
   Communication Port                                Printer Port (LPT1)

Display:
   Video Adapter                                     NVIDIA GeForce 6600  (512 MB)
   3D Accelerator                                    nVIDIA GeForce 6600 PCI-E

Multimedia:
   Audio Adapter   Creative SB Live! 24-bit (CA0106) Integrated Audio Processor on MSI motherboard

DMI:
   DMI BIOS Vendor                                   Phoenix Technologies, LTD
   DMI BIOS Version                                  6.00 PG
   DMI System Manufacturer                           MICRO-STAR INTERNATIONAL CO., LTD
   DMI System Product                                MS-7100
   DMI System Version                                1.0
   DMI Motherboard Manufacturer                      MICRO-STAR INTERNATIONAL CO., LTD
   DMI Motherboard Product                           MS-7100
   DMI Motherboard Version                           1.0
   DMI Chassis Type                                  Desktop Case
   DMI Total / Free Memory Sockets                   4 / 2

aleph

  • Guest
Re: What is this strange systray icon??
« Reply #21 on: December 06, 2005, 01:55:35 AM »
Oh yeah.  To be specific... when I say reinstall -- I mean the OS.  Have dualboot w/ XP x64, but I rarely every run that.

Offline alanrf

  • Avast Evangelist
  • Massive Poster
  • ***
  • Posts: 3870
  • Just an avast user
Re: What is this strange systray icon??
« Reply #22 on: December 06, 2005, 05:05:41 AM »
Do you have any tasks in the Control Panel > Scheduled Tasks that you do not recognize?

The IP address address you posted above is registered to an outfit in Montevideo, Uruguay.  Do you know of any reason you would be connecting to a server in Uruguay?  Might you be checking with a software development group in Uruguay for product update information (yes, there are software development groups in Uruguay)?

I think it might prove useful to create (for a while) a more detailed avast! log of your mail connections. 

You can get the mailscanner to log your connections by editing the avast4.ini file (in  Program Files\Alwil Software\Avast4\DATA folder).

In the section headed:

[MailScanner]

add the line:

Log=20

and save the updated file.

The log will be in Program Files\Alwil Software\Avast4\DATA\log\ashmaisv.log
« Last Edit: December 06, 2005, 10:39:57 AM by alanrf »

Offline szc

  • Avast Evangelist
  • Starting Graphoman
  • ***
  • Posts: 6927
Re: What is this strange systray icon??
« Reply #23 on: December 06, 2005, 10:15:57 AM »
Good point and good advice regarding creation of mail activity log file... aleph, do that and post back.

However, Montevideo, Uruguay is just "first stop" for this IP range... This IP address range is under LACNIC ( whois.lacnic.net ), and this is what I get when checking that IP over there at LACNIC:

Quote
% Joint Whois - whois.lacnic.net
%  This server accepts single ASN, IPv4 or IPv6 queries
 

% Copyright LACNIC lacnic.net
%  The data below is provided for information purposes
%  and to assist persons in obtaining information about or
%  related to AS and IP numbers registrations
%  By submitting a whois query, you agree to use this data
%  only for lawful purposes.
%  2005-12-06 07:13:04 (BRST -02:00)

inetnum:     200.104.0/18
status:      allocated
owner:       VTR BANDA ANCHA S.A.
ownerid:     CL-VPNS-LACNIC
responsible: Italo Sambuceti
address:     Reyes Lavalle, 3340, 4th floor
address:     6760335 - Santiago -
country:     CL
phone:       +56 02 3101502 []
owner-c:     ISO
tech-c:      ISO
inetrev:     200.104.0/18
nserver:     NS00.VTR.NET 
nsstat:      20051202 AA
nslastaa:    20051202
nserver:     NS01.VTR.NET 
nsstat:      20051202 AA
nslastaa:    20051202
created:     20021223
changed:     20021223

nic-hdl:     ISO
person:      Italo Sambuceti Oyarzún
e-mail:      isambuce@VTR.CL
address:     Reyes Lavalle, 3340, 4 th floor
address:     676-0335 - Santiago -
country:     CL
phone:       +56 02 3101609 []
created:     20020906
changed:     20021122

% whois.lacnic.net accepts only direct match queries.
% Types of queries are: POCs, ownerid, CIDR blocks, IP
% and AS numbers.

Not far though... still in South America, Santiago, Chile.
MB: GIGABYTE GA-Z77X-UD3H Intel 7 Series  - LGA1155, CPU: Intel Core i5-3570K - Quad Core, 3.40GHz (3.80GHz Max Turbo), CPU COOLER: Cooler Master Hyper 212 EVO Direct Heat Pipe R2, RAM: 16 GB Kingston HyperX Blu DDR3, VIDEO CARD: Galaxy GeForce GTX 560 Ti - 1GB, GDDR5, POWER SUPPLY: Corsair Enthusiast Series TX750 V2 - 750 Watts, HD: Seagate Barracuda - 2TB, 7200RPM, 64MB, SATA 6Gb/s

Offline oldman

  • Avast Evangelist
  • Massive Poster
  • ***
  • Posts: 4142
  • Some days..... MOS...this bug's for you
Re: What is this strange systray icon??
« Reply #24 on: December 07, 2005, 02:58:50 AM »
Hmmm... the address and Uruguay kinda rang a bell. Abou a month ago, I was setting up a firewall on another computer and the 201.8.6.145 address showed up in the blocked log. As far as I know, the only thing on that computer, besides Windows, was shareza. But it generally commuicates through a set port. Perhaps someone looking for music?

Even if this was the case and aleph has a file sharing program on his computer, it doesn't explain the mail sanner icon.


whois lookup


OrgName:    Latin American and Caribbean IP address Regional Registry
OrgID:      LACNIC
Address:    Potosi 1517
City:       Montevideo
StateProv: 
PostalCode: 11500
Country:    UY

ReferralServer: whois://whois.lacnic.net

NetRange:   201.0.0.0 - 201.255.255.255
CIDR:       201.0.0.0/8
NetName:    LACNIC-201
NetHandle:  NET-201-0-0-0-1
Parent:     
NetType:    Allocated to LACNIC
NameServer: NS.LACNIC.NET
NameServer: NS2.DNS.BR
NameServer: TINNIE.ARIN.NET
NameServer: NS-SEC.RIPE.NET
NameServer: SEC3.APNIC.NET
NameServer: NS1.AFRINIC.NET
Comment:    This IP address range is under LACNIC responsibility
Comment:    for further allocations to users in LACNIC region.
Comment:    Please see http://www.lacnic.net/ for further details,
Comment:    or check the WHOIS server located at whois.lacnic.net
RegDate:    2003-04-03
Updated:    2005-12-05

OrgTechHandle: LACNIC-ARIN
OrgTechName:   LACNIC Whois Info
OrgTechPhone:  (+55) 11 5509-3522
OrgTechEmail:  whois-contact@lacnic.net

# ARIN WHOIS database, last updated 2005-12-05 19:10
# Enter ? for additional hints on searching ARIN's WHOIS database.

Offline szc

  • Avast Evangelist
  • Starting Graphoman
  • ***
  • Posts: 6927
Re: What is this strange systray icon??
« Reply #25 on: December 07, 2005, 03:53:47 AM »
Those WHOIS information, alanrf already provided in his reply in this same thread:

http://forum.avast.com/index.php?topic=17797.msg152083#msg152083

However, if you take a good look at these lines:

Quote
Comment:    This IP address range is under LACNIC responsibility
Comment:    for further allocations to users in LACNIC region.
Comment:    Please see http://www.lacnic.net/ for further details,
Comment:    or check the WHOIS server located at whois.lacnic.net

You'll spot the information I marked in BLUE.

When you search that IP at LACNIC, you get exactly what I posted above in my previous reply.
MB: GIGABYTE GA-Z77X-UD3H Intel 7 Series  - LGA1155, CPU: Intel Core i5-3570K - Quad Core, 3.40GHz (3.80GHz Max Turbo), CPU COOLER: Cooler Master Hyper 212 EVO Direct Heat Pipe R2, RAM: 16 GB Kingston HyperX Blu DDR3, VIDEO CARD: Galaxy GeForce GTX 560 Ti - 1GB, GDDR5, POWER SUPPLY: Corsair Enthusiast Series TX750 V2 - 750 Watts, HD: Seagate Barracuda - 2TB, 7200RPM, 64MB, SATA 6Gb/s

aleph

  • Guest
Re: What is this strange systray icon??
« Reply #26 on: December 09, 2005, 05:44:08 PM »
Thanks for all your help.  Alan, I have NO scheduled tasks.  I had already whois'ed them to see if there might be some reason why I'd have a mail connection to them.  None that I can think of.  I will change the logging settings and get back when I find something.   

Thanks again!

aleph

  • Guest
Re: What is this strange systray icon??
« Reply #27 on: December 09, 2005, 05:47:23 PM »
Oh, yeah.  What is the value log=20?  Is 20 line numbers, size??

Offline Lisandro

  • Avast team
  • Certainly Bot
  • *
  • Posts: 67195
Re: What is this strange systray icon??
« Reply #28 on: December 09, 2005, 05:54:48 PM »
Oh, yeah.  What is the value log=20?  Is 20 line numbers, size??
No, it specifies the level of logging: disable log = 0; basic information (only initial loading info, errors and avast4.ini changes; default) = 1, all the communication data between the Mail scanner and mail servers = 20. Other values between 0 and 20 are not significant. Information is written into AswMaiSv.log file in Avast4\Data\LOG folder.
The best things in life are free.

OB1

  • Guest
Re: What is this strange systray icon??
« Reply #29 on: December 21, 2005, 09:26:49 PM »
Are you connecting to a usenet (nntp) server by any chance?
That will be scanned by the internet mail provider as well, causing the same icon to appear.

OB1